SeedProject base — cloneable Astro + PHP foundation for new sites
Find a file
Carlos Arias 3f69000d27 feat: never throttle trusted server-local callers + harden session cookie
Two self-contained framework fixes, no schema dependencies:

- throttle(): exempt trusted callers via new Functions::isTrustedIp() — loopback, the
  server's own IP, and an optional TRUSTED_IPS config allowlist (IPs/CIDRs). Fixes the SSG
  build (which fetches the read API from the box thousands of times per build) tripping the
  public rate limit and baking empty data into the deploy. Public client IPs stay limited.
- public/index.php: set secure session cookie params (httponly, SameSite=Lax, secure on
  https) before session_start, so session/login state rides on a hardened cookie.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FMQeUnUrAeexcZ7P2Hxa6G
2026-07-11 09:01:49 -05:00
api feat: never throttle trusted server-local callers + harden session cookie 2026-07-11 09:01:49 -05:00
app drawer: sync visual element picker from astroagent 2026-07-05 00:46:30 +00:00
content-pipeline fix(configure): set content-pipeline projectRoot to the clone's path (was comiida's) 2026-07-04 23:34:58 +00:00
scripts fix(configure): set content-pipeline projectRoot to the clone's path (was comiida's) 2026-07-04 23:34:58 +00:00
.gitignore fix: repair the fresh-clone flow — track api/public + app/public, fix installer schema 2026-07-05 00:15:55 +00:00
AGENTS.md docs: mark content-pipeline as deferred (niche-specific placeholder pending DB rewrite) 2026-07-04 23:44:51 +00:00
astroagent.config.json docs: add root AGENTS.md + CLAUDE.md for fresh-clone agents; fix agentUser leftover 2026-07-04 23:33:50 +00:00
CLAUDE.md docs: add root AGENTS.md + CLAUDE.md for fresh-clone agents; fix agentUser leftover 2026-07-04 23:33:50 +00:00
README.md feat: clone tooling — scripts/new-site.sh + README 2026-07-04 23:09:37 +00:00
site.config.json feat: config-driven identity (site.config.json) + buildable sample content 2026-07-04 23:06:23 +00:00

SeedProject base

A cloneable foundation for building websites — a static Astro frontend with a PHP backend, an AI authoring console, and an autonomous content pipeline. Clone it, set one config file, and build out a new site (a lawyer's office, a roofing company, a niche publication) the way you'd spin up a new WordPress install — but faster to host and safer to run.

What's inside

Path Role "WordPress equivalent"
app/ Astro theme — layouts, components, content collections, sample post theme + posts
api/ SeedProject PHP framework — the dynamic backend (DB, forms, metrics, agents) PHP core
content-pipeline/ Autonomous content engine — research, write, review, publish (no equivalent)
astroagent.config.json + app/.astroagent/ AI authoring console — change the site in plain English wp-admin
site.config.json Single source of site identity — the one file you edit per site wp-config + Site Settings

Quick start — spin up a new site

git clone https://repo.carlosarias.com/carlos/seedproject-web.git my-site
cd my-site
./scripts/new-site.sh          # prompts for name/URL/author → writes site.config.json,
                               # stamps every engine, (optionally) resets git + installs deps
cd app && npm run build        # builds the static site into ./public

Then point a web server's document root at ./public and alias /api to ./api (see Backend).

The one file you edit: site.config.json

All site identity lives here:

{
  "name": "Acme Roofing",
  "url": "https://acmeroofing.com",
  "description": "Denver's trusted roofing contractor since 1998.",
  "tagline": "Roofs done right",
  "language": "en",
  "timezone": "America/Denver",
  "topic": "residential and commercial roofing",
  "audience": "Denver-area homeowners and property managers",
  "author": { "slug": "acme", "name": "Acme Roofing", "jobTitle": "...", "avatar": "/avatar-placeholder.png", "bio": "...", "longBio": "...", "knowsAbout": [], "sameAs": [] },
  "social": { "twitter": "" }
}

After editing it, run:

node scripts/configure.mjs

This stamps the values into the Astro theme (app/src/config/site.json), content-pipeline/config.json, and astroagent.config.json so all three engines share one identity. new-site.sh runs it for you.

Backend (api/)

The api/ directory is the SeedProject PHP framework, meant to be served at /api on the same domain (the static frontend calls it same-origin). It needs:

  • Composer deps: cd api && composer install
  • Config: api/config.php with your database credentials (git-ignored). Until the CLI installer ships (see below), create it by hand or use the framework's web installer under api/install/.
  • A PHP-FPM handler in your web server for /api, with a front-controller rewrite to api/index.php. Example Apache/nginx snippets are in api/.memory/foundation.md.

Planned — the Foundation: a php console app:install (DB + config + schema) and php console db:migrate, plus a two-tier auth layer and a /api/health round-trip. Design + implementation plan: api/.memory/foundation.md and api/.memory/foundation-plan.md.

Content pipeline & authoring

  • content-pipeline/ — autonomous research/write/review/publish scripts driven by content-pipeline/config.json (populated from site.config.json). Runtime state (drafts/, state/, logs/, queues) is git-ignored and regenerates per site.
  • astroagent — the in-site console for making changes in plain English; its identity comes from astroagent.config.json.

Directory layout

my-site/
├── site.config.json          ← edit this
├── scripts/
│   ├── new-site.sh           ← one-time setup for a fresh clone
│   └── configure.mjs         ← stamp site.config.json into every engine
├── app/                      ← Astro frontend (build → ../public)
├── api/                      ← SeedProject PHP backend (served at /api)
├── content-pipeline/         ← autonomous content engine
└── public/                   ← build output (git-ignored)

What's git-ignored

Secrets (**/.env, api/config.php), dependencies (node_modules/, api/vendor/), build output (public/, app/dist/), and per-site runtime state. A fresh clone installs deps and generates the rest.